A remote attacker can inject arbitrary SQL through the "pwd" parameter in the eprocess.php endpoint of the Employee Management System 1.0. This flaw is a classic SQL injection (CWE‑89) caused by inadequate handling of user input (CWE‑74), which allows manipulation of the internal SQL query. Successful exploitation can lead to unauthorized reading, alteration, or removal of database records, thereby threatening the confidentiality and integrity of the system’s data and potentially enabling further privilege escalation depending on the database user rights.

code‑projects Employee Management System version 1.0 contains the vulnerable code in /370project/process/eprocess.php of the Endpoint component. No other vendor versions or products are listed in the data.

The CVSS score of 6.9 denotes a moderate severity flaw. The EPSS score is reported as < 1%, suggesting limited public exploitation, yet the vulnerability is publicly disclosed. It is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by sending a crafted HTTP request to the eprocess.php endpoint with a malicious "pwd" value; no authentication or special privileges are required to execute the injection.